Privacy Policy.

1. Information this site handles.

• Family accounts: display names, sign-in emails, roles and password hashes. Passwords are not stored as readable text.
• Portfolio records: titles, dates, categories, summaries, reflections, skills, contributions and recognition details supplied by the family.
• Evidence: original uploaded images, video, audio and PDFs; filenames, captions, file sizes and media types; YouTube identifiers and supporting links.
• Account recovery: hashed reset tokens, expiry times, reset-request limits and operational recovery emails. Reset links expire after 30 minutes; expired database records are cleaned when recovery requests are processed.
• Session/security information: a session identifier and server-side session data, including for visitors whose session is started by the website. Failed sign-ins are counted against a hash of the requesting IP address.
• Hosting logs: the host may record IP addresses, timestamps, requested pages, browser information and errors under its server configuration.

Public visitors are not asked to register. The website has no public comments, visitor upload form, advertising system, third-party analytics integration or marketing mailing list.

2. Why information is used.

Information supports family sign-in, evidence storage, project presentation, parent review, media delivery, access protection, password recovery and responses to enquiries. The family chooses what becomes public. The portfolio is not used to sell personal information, build advertising profiles or rank children.

Where data-protection law applies, processing must have an applicable lawful basis. Parent management is a product safeguard; it does not by itself establish permission to publish another person’s information or satisfy every legal requirement. The operator must establish appropriate authority and permissions, especially for children’s information.

3. Private work and public work.

New entries begin as private drafts. Drafts and entries under review are accessible to signed-in family accounts. Only a parent can publish. Child changes to published entries return them to review.

Published entries and attached evidence can be viewed, downloaded, indexed and shared by visitors. Sharing is not limited to scholarship reviewers. Authorised hosting or technical administrators may access stored information to operate or support the website.

Review faces, certificates, names, school details, routines, locations, contact details and original file metadata before publishing. This site does not automatically strip metadata. Obtain appropriate permission before including other people’s work, image, voice or personal information.

Making an entry private stops ordinary access here; it cannot recall copies already downloaded, forwarded, indexed or cached elsewhere.

4. Cookies and sessions.

A session cookie associates browser requests with session data and keeps signed-in users authenticated. It is marked HttpOnly and SameSite=Lax, and Secure when the connection is recognised as HTTPS. It is not an advertising cookie. Browsers generally remove session cookies at the end of a session, subject to restore settings. Server session retention follows hosting configuration.

Blocking cookies may prevent studio sign-in and forms from working correctly. This website does not currently include optional analytics or advertising cookies requiring a preference control.

5. YouTube, external links and social sharing.

A YouTube player loads only after you choose Load video. It uses YouTube’s privacy-enhanced domain, but Google/YouTube still processes information under its own policies when you interact with it. This is not a promise of anonymous viewing. Watch on YouTube is available as an alternative.

WhatsApp, Facebook, LinkedIn, X and device-sharing controls let you choose whether to send or post a public URL. Nothing is posted automatically. Following a link or opening a share service enters that provider’s environment, where its own terms and privacy practices apply.

See Google’s Privacy Policy and YouTube’s embedding guidance.

6. Storage and security.

Accounts and portfolio records are stored in the database; original evidence and sessions are stored on the server. The application uses password hashing, access checks and protected storage paths. Public hosting should use HTTPS. No system can guarantee absolute security.

Hosting location: Axxess Hosting

Hosting/support and external video/social providers may process information in other countries. Before launch, the operator must confirm hosting locations, access arrangements and any safeguards required by applicable law. The application does not establish those contractual arrangements.

7. Retention and removal.

The family retains evidence while it remains useful for documenting learning, unless deleted. Parent controls can edit, unpublish or permanently delete entries and originals. There is no automatic portfolio expiry or in-app recovery bin.

Failed sign-in records older than 15 minutes are cleaned during subsequent login processing, rather than by a guaranteed scheduled cleanup. Sessions, server logs and backups follow the host/operator’s settings. Deleted content may remain in backups until those copies expire or are removed. These retention settings must be confirmed during hosting setup.

8. Access, correction and concerns.

If information about you appears here, ask the parent or guardian to explain its use, correct it, remove it, restrict publication or provide access where applicable law entitles you to it. A legally authorised representative may make an appropriate request for a child. Proportionate confirmation of identity or authority may be needed before private information is released or changed.

Identify the page and requested action. Requests should be handled under applicable law; this notice does not promise a response time or unconditional deletion right that may not apply in every case.

If South African data-protection law applies, privacy information is available from the Information Regulator and its complaints page. Other jurisdictions may have a different competent authority.

9. Changes to this notice.

The date above identifies this version. Review this notice when information practices change, including before adding analytics, contact forms, public registration or new external services.